Shared Token Storage for Mobile App Single Sign-On
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure identity systems require separate sign-on processes for each application, necessitating redundant user credential entry, even when applications share the same credentials and authorization service.
Innovation Solution
Implementing a shared secure storage on a computing device for tokens, managed by an identity management SDK, allowing a single sign-on across multiple applications by storing and sharing authorization tokens, decoupling authorization from session management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate sign-on processes are used for each application, then security verification is performed for each application, but user credential entry is repeated and operation complexity increases
Solution Approach 1:
The system performs preliminary authentication by obtaining authorization tokens from the central authorization service during the first sign-on process. These tokens are stored in secure storage and reused for subsequent applications, eliminating the need for repeated credential entry while maintaining security verification through the pre-obtained tokens
Solution Approach 2:
The system creates copies of authorization tokens obtained from the central authorization service and stores them in secure storage. These token copies are then reused across multiple applications, allowing the system to maintain security verification without requiring users to re-enter credentials for each application
2Reliability
If separate sign-on processes are used for each application, then each application independently verifies credentials, but system complexity and development overhead increase
Solution Approach 1:
The system merges the authorization management functionality into a unified mechanism where a single authentication process obtains tokens that are shared across multiple applications. The secure storage and token management system consolidates what would otherwise be separate verification processes, reducing development overhead while maintaining independent verification through the centralized token system
Solution Approach 2:
The authorization token obtained through a single sign-on process serves multiple functions across different applications. The token system is designed to be universal, allowing the same token to be used for verifying user credentials in multiple applications, thereby reducing system complexity while maintaining independent verification capabilities
3Ease of operation
If authorization tokens are shared across applications, then single sign-on is enabled, but secure storage and token management complexity increases
Solution Approach 1:
The system implements self-service through automated token management where the secure storage automatically handles token persistence, retrieval, and validation. The token management system operates autonomously to enable single sign-on across applications without requiring manual intervention, reducing the operational complexity despite the enhanced storage requirements
Data Source
AI summary
Systems and methods are disclosed for accessing protected data. A computing device may have a secured stared storage accessible by two or more applications operating on the mobile device. The computing device may obtain a first token from an authorization service to verify user identity for a first application. The first token may be stored in the shared storage area, and be accessible to one or more applications sharing the storage space. In response to a user attempt to access a web service using a second application, the user identity may be verified using the first token. The authorization service may verify user credentials, and send a second token to the computing device. The second token may be a proxy ticket authorizing access and exchange of protected data between the second application and a web service. The second token may also be stored in the secure storage area.